﻿#ifndef SYSTEMSERVICE_H
#define SYSTEMSERVICE_H
#include <typesdef.h>
#include <fileservice.h>
#include <disassembleservice.h>
class SystemService
{
public:
    SystemService();

    //用于打印十六进制数据
    static QString  GetFormatULONG64(ULONG64 code);
    //用于打印十六进制内核状态码
    static QString GetFormatNtstatus(NTSTATUS ntstatus);

    QString GetSystemRoot();
    //初始化运行环境(变量,系统函数等)
    VOID InitializationEnvironment();
    //内存映射
    NTSTATUS NtMapViewOfSectionImpl(HANDLE hSection,HANDLE hProcess,PVOID* mappedAddress,PSIZE_T ViewSize);
    //内存映射
    NTSTATUS NtCreateSectionImpl(PHANDLE hSection,HANDLE hFile);
    //卸载模块
    bool NtUnmapViewOfSectionImpl(ULONG dwPId,PVOID  BaseAddress);
    //映射DLL文件到指定的进程空间
    bool MapViewOfSzDllPath(ULONG dwPId,QString szExePath,PULONG64 mapperBase);
    //NtOpenSection包装方法
    NTSTATUS NtOpenSectionImpl(PHANDLE hSection, QString qStringFilePath);

    //计算ShellCode函数 字节大小,用于写入其它进程使用
   static ULONG ShellCodeLength;

    //初始化UnicodeString
    RtlInitUnicodeStringDef RtlInitUnicodeString;

    //定义 ntdll.dll 中未文档化函数LdrLoadDll用于加载DLL
    static LdrLoadDllDef LdrLoadDll64;
    //32位kernel32.dll导出函数LoadLibraryA的地址
    static ULONG_PTR LoadLibraryA32;
    //64位kernel32.dll导出函数LoadLibraryA的地址
    static ULONG_PTR LoadLibraryA64;

    static NtTerminateThreadDef NtTerminateThread;

    NtCreateThreadExDef NtCreateThreadEx;
    //Descriptor:用于计算函数大小字节数
    ULONG GetSpecifiedFunctionLengthC(ULONG_PTR fn,ULONG sCount);

    ULONG GetSpecifiedFunctionLengthD(ULONG_PTR fn,ULONG sCount);

    QString GetLastErrorText(ULONG ErrorCode);
    //Descriptor:获取操作系统版本
    bool GetSystemAndNtVersion(POSVersionBean osVersionBean);

private:
    QString SystemRoot;

    //提供文件操作服务
    FileService fileService;
    //提供反汇编服务
    DisassembleService disassembleService;

    NtUnmapViewOfSectionDef NtUnmapViewOfSection;
    //创建内存节
    NtCreateSectionDef NtCreateSection;
    //映射内存
    NtMapViewOfSectionDef NtMapViewOfSection;
    //打开内存节
    NtOpenSectionDef NtOpenSection;

};

#endif // SYSTEMSERVICE_H
